Unauthenticated RCE in Samba SAMR check password script

This repository is a small collection of three standalone Python proof-of-concept exploits plus a README and license. It is not tied to a common exploitation framework. The code files are CVE-2026-28372.py, CVE-2026-4408.py, and CVE-2026-4480.py, each with its own argparse-based CLI and main() entry point. CVE-2026-28372.py is a Telnet client-side exploit for a TelnetD authentication bypass/local privilege escalation scenario. It implements Telnet option negotiation manually, specifically NEW-ENVIRON handling, and injects environment variables into the server-side login process. Before connecting, it creates a local file at /tmp/login.noauth by default containing 'yes'. It then sets CREDENTIALS_DIRECTORY to the parent directory of that file and USER to the requested username (default root). The exploit connects to the target Telnet service, responds to DO/WILL/SB negotiation, sends the crafted environment block, and provides an interactive session. Main capability: bypass login authentication and obtain a shell as root or another chosen user. Attack vector is network to the Telnet service, but the vulnerability effect is local privilege escalation on the target. CVE-2026-4408.py is a Samba SAMR remote code execution PoC built with Impacket DCERPC primitives. It binds to Samba over ncacn_ip_tcp and either uses a user-specified port or brute-forces the likely dynamic SAMR port range 49152-49251. The exploit crafts a SAM_VALIDATE_INPUT_ARG structure and abuses hSamrValidatePassword by placing the attacker-controlled command string into UserAccountName. The README explains this reaches a vulnerable 'check password script' path where %u is inserted into a shell command without proper escaping. Main capability: remote arbitrary command execution on a Samba host, optionally unauthenticated depending on service exposure and configuration. CVE-2026-4480.py is another Samba RCE PoC using the spoolss/RPRN interface over the named pipe \\pipe\\spoolss. It defines custom NDR call structures for RpcStartDocPrinter, RpcWritePrinter, and RpcEndDocPrinter, opens a printer handle, submits a print job whose DocName is the attacker-controlled command, writes a few bytes of dummy print data, and ends the job to trigger execution. The vulnerable path is Samba's generic_job_submit when the print command contains %J and printing is configured unsafely. Main capability: remote arbitrary command execution through print job metadata injection. Overall, the repository's purpose is to demonstrate legacy Linux service exploitation paths discussed in the accompanying conference talk. The PoCs are operational rather than heavily weaponized: they provide direct exploitation and command execution/session access, but payload customization is manual through command-line arguments rather than modular framework support.